Recover data from partition overwritten by swap partition

Question

I've just reinstalled Ubuntu, and I chose a partition full of data as a swap area. I didn't realize that the swap area would overwrite my files.

Can I recover my partition or my data now?

score 2 · Answer 1 · edited Nov 12 '11 at 21:43

2

What you could do, is take a dd image of your swap, bit by bit:

dd if=/your/swap of=/path/to/file.dd

"Your swap" is usually a separate partition. To find out which one do:

fdisk -l

once you obtain the .dd file, install autopsy:

 apt-get install autopsy

run it as root in your terminal, and open a browser as instructed.

Create a case in autopsy, and try recovering data in this way. It may be complicated, but first secure the .dd file, then try forensic techniques recovering files. You may want to read up on autopsy as a forensic tool for data recovery.

edited Nov 12 '11 at 21:43

N.N.

18,219

answered Nov 12 '11 at 21:36

den4uk

432

I've searched how can I use autopsy and I get this https://help.ubuntu.com/community/DataRecovery
but the say that this apply for old 7.04 7.10 8.04, so can I use this way since I have 11.10
– Muhammad Jawabreh Nov 12 '11 at 21:47
and I'm totally new to Ubuntu, so could you be more specific about the directory (if=/your/swap) – Muhammad Jawabreh Nov 12 '11 at 21:59
can you show me your output for this command: $ sudo fdisk -l – den4uk Nov 12 '11 at 22:34
I'm now using Windows, because I don't want to lose more data, so tell me what to do please – Muhammad Jawabreh Nov 12 '11 at 22:47
If you're on windows, the download FTK Imager free from accessdata.com, and try recover deleted files. You first need to mount the hard drive, then lookup deleted entries. You still could recoved deleted files. Best luck! – den4uk Nov 12 '11 at 22:59
I thought that there is a command can make this easily, just to make the swap partition as a normal partition – Muhammad Jawabreh Nov 12 '11 at 23:14
That's impossible, because the swap partition was already used, and some data in there are overwritten, so other data recovery means are needed. Try den4uk's tip. – Rafał Cieślak Nov 13 '11 at 11:51
now I need tutorial how to use FTK Imager ! – Muhammad Jawabreh Nov 13 '11 at 12:38
can you give me some tips please – Muhammad Jawabreh Nov 13 '11 at 12:38

Recover data from partition overwritten by swap partition

1 Answers1